CVE-2026-116289

Gitea did not reject personal access tokens restricted to public resources public-only on the organization Actions runner registration-token endpoint, and the runner registered with the resulting token was not limited to public repositories. Holding only such a token with write:organization that...

CVE-2026-116289 Gitea public-only token bypass through Actions runner registration

Gitea did not reject personal access tokens restricted to public resources public-only on the organization Actions runner registration-token endpoint, and the runner registered with the resulting token was not limited to public repositories. Holding only such a token with write:organization that...

CVE-2026-116289

Gitea fails to reject personal access tokens restricted to public resources (public-only) on the organization Actions runner registration-token endpoint. Because the resulting runner is not restricted to public repositories, an attacker possessing a write:organization token belonging to a public ...

CVE-2026-116289: Gitea: Gitea did not reject personal access tokens restricted to public resources (`public-only`) on the organization Actions…

Gitea did not reject personal access tokens restricted to public resources public-only on the organization Actions runner registration-token endpoint, and the runner registered with the resulting token was not limited to public repositories. Holding only such a token with write:organization that...

PT-2026-134870

Gitea did not reject personal access tokens restricted to public resources public-only on the organization Actions runner registration-token endpoint, and the runner registered with the resulting token was not limited to public repositories. Holding only such a token with write:organization that...

gitea-public-only-pat-org

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · gitea-public-only-pat-org Write-up: https://abraxaslabs.tech/research/gitea-public-only-pat-org gitea-public-only-pat-org Gitea 1.27.3 - Gitea public-only on a PAT is supposed to be the promise that the token cannot...

CVE-2026-70396

Gitea's organization repository-creation API requires write:organization but omits the write:repository token scope enforced by other repository-creation routes. A personal access token or OAuth application token without repository-write scope can therefore create organization-owned repositories ...

EUVD-2026-101093

Gitea's organization repository-creation API requires write:organization but omits the write:repository token scope enforced by other repository-creation routes. A personal access token or OAuth application token without repository-write scope can therefore create organization-owned repositories ...

CVE-2026-70396

Gitea's organization repository-creation API requires write:organization but omits the write:repository token scope enforced by other repository-creation routes. A personal access token or OAuth application token without repository-write scope can therefore create organization-owned repositories ...

CVE-2026-70396

The Gitea organization repository-creation API suffers from an Incorrect Authorization vulnerability (CWE-863 ). While the API requires the write:organization scope, it fails to enforce the write:repository token scope required by other repository-creation routes. This allows a personal access to...

PT-2026-114255

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description The organization repository-creation API fails to enforce the write:repository token scope, requiring only the write:organization scope. This allows a personal access token or OAuth application...

FreeBSD: VID-fac18f5f-afc2-11f1-8266-3c7c3fba4204 (CVE-2026-70396): Gitea -- multiple vulnerabilities

Gitea's organization repository-creation API requires write:organization but omits the write:repository token scope enforced by other repository-creation routes. A personal access token or OAuth application token without repository-write scope can therefore create organization-owned repositories ...

CVE-2026-70396

"POST /api/v1/orgs/org/repos" allows a token scoped only to "write:organization" to create repositories in an organization, even though the deprecated sibling route and other repository-creation routes also require "write:repository". A PAT or OAuth app without "write:repository" can create...